Rocky&#x27;s docs are also really nice. They aren&#x27;t as thorough as RedHat&#x27;s, but they&#x27;re much more readable and concise, and tend to be written for a less enterprise-y audience.

Thanks!I don&#x27;t care much about being fully RHEL compatible, or no ABI changes at all. I just want a system that gets security fixes quickly with as little chances of breaking things as possible.

&gt; But are they maintained well?Alma has a few affordances as it&#x27;s no longer RHEL source compatible, which means it could ship priviledge escalation fixes with new kernel updates faster.Rocky responded with an extra, optional to enable, security repo to provide mitigations to the exploits while waiting for RHEL to downstream.Look pretty well maintained to me. If only judging by recent events.

Alma and Rocky if you want fully free or have a lot of machines. RHEL if you are okay with registering with them; they give ten machines free access to their updates for each Registered account in their system.RHEL is definitely the most stable major distribution. Alma and Rocky are essentially downstream clones of RHEL.

It usually doesn&#x27;t live until the end of the support cycle. And if it does I will probably migrate it to a fresh VM instead of upgrading the distribution.

You are betting that whatever you host doesn&#x27;t live as long as the upgrade cycle because it&#x27;ll probably be a pain when the upgrades finally arrive. I&#x27;d rather have smaller version jumps more often than a huge jump with everything changing after a long time.

5 years is not a lot. It releases every 2 years, so it requires upgrading at least every 4 years. In the worst case it&#x27;s just 3 years of support, if you install right before the next release.ELTS is 10 years and paid. It&#x27;s great that it exists, but not relevant for my toy projects.

&gt; why do you care that much?I&#x27;ve had issues with Ubuntu&#x2F;Debian upgrades more than once. Some third party binaries breaking with the update. Or some specific config tweaks that break, because the structure of &#x2F;etc changed too much.For some small VM with a specific purpose I prefer a distribution that changes as little as possible for as long as possible. Less work, more uptime.

&gt; The question is...why do you care that much?Not the OP, but I support Ubuntu as desktop and server OS for an engineering collage and have for 10ish years. Some LTS upgrades don&#x27;t require many changes (mostly minor package name changes) and some take months of work to get rolled out (mostly for workstations, the server upgrades are usually quick.). Not everything gets upgraded every new OS release. If we had to upgrade everything every 6-12 months it would eat up a significant amount of time for our small team.

I had unattended-upgrades cripple our VMs

Probably Debian or Ubuntu. The question is...why do you care that much?I&#x27;ve upgraded Debian stable (both pure and with some cherry-picked backports) and Ubuntu (non-LTS and LTS) systems in place and rarely broken anything, for years and years. When stuff has broken it&#x27;s been a quick google and then slapping myself for not having read the upgrade guide.I do generally wait about 2-3 weeks before upgrading, giving time for them to catch stuff that was missed until the great masses were set loose on it.

I need to enable automatic updates, because I don&#x27;t have the time to manually update. I have a few machines on Open SuSE Tubleweed, and stuff just randomly breaks. A few months ago there was a weird Kernel bug that just froze all of them. They update and reboot every day, and suddenly it all worked well again. A bit too exciting for me :)

Use a rolling release like Arch and it’s supported forever.

Slightly off topic: What&#x27;s currently the free Linux distribution with the longest support cycle?For a while I used CentOS 7 on all of those small VMs, because it got security updates for a really long time. With minimal risk of breaking things on updates.PS: after a bit of research Alma&#x2F;Rocky Linux are probably the best choices for now. 10 years of support. But are they maintained well?

Personally, I&#x27;ve been running with Caddy in front of Docker (compose) for most of my personal&#x2F;hobby usage. If it&#x27;s a straight website, I&#x27;ll let Caddy serve the contents directly... for &quot;web apps&quot; I&#x27;ll pretty much containerize all the things and use caddy for TLS termination and reverse-proxy duties to the app running under Docker...Mostly ~&#x2F;apps&#x2F;appname, where each appname has a docker compose file, and the data directories mounted under appname... I can compose down and (s)ftp the data out for hard archives or to move a site&#x2F;service. I had been running a few VMs under a dedicated server, but switched to separate VPSes on OVH. Only gotcha with OVH is if you want to run mail, you want to avoid the local zone VMs that don&#x27;t allow mail hosting.YMMV

&gt; - PM2 was buggy on FreeBSD, which I used to manage my processesFor supervision?&gt; - An alternative, using `rc.d` to run daemons was just so hard to get logs working.The unix way is to use logger(1) If you only want some simple message, or redirect to files using newsyslog(8) for managing the sizes of the files.&gt; The firewall required too much self configuration to get it right with all the best security practices (ie. What does one do with ICMP.) I was missing something like a template with the defaults that come with UFW, for instance.I would recommend The Book of PF[0]. While FreeBSD has syntax difference with OpenBSD&#x27;s pf, this should give you enough insight on how a firewall operates to get a sense of what rules to write.[0]: <a href="https:&#x2F;&#x2F;nostarch.com&#x2F;book-of-pf-4e" rel="nofollow">https:&#x2F;&#x2F;nostarch.com&#x2F;book-of-pf-4e</a>

I enjoyed my foray into trying FreeBSD for my personal server. There&#x27;s something cool, clean, simple and &quot;punk rock&quot; about it. But I gave up as my main pain points were:- PM2 was buggy on FreeBSD, which I used to manage my processes- An alternative, using `rc.d` to run daemons was just so hard to get logs working.- The firewall required too much self configuration to get it right with all the best security practices (ie. What does one do with ICMP.) I was missing something like a template with the defaults that come with UFW, for instance.

FWIW, I once abandoned an Ubuntu server for a decade, and managed to update it painlessly in 20 minutes. That same server is still running today, now with the latest LTS. I think I might have even started with Ubuntu 4, or perhaps 6, and it has been painless all the way through. Perhaps my slow upgrades saved me from early adopter woes :).I use Debian now much more. With all the supply chain attacks, Debian Stable feels like an absolute jewel, even if there are always a few packages I need to handle separately because I want or need a more updated version. But I love the old school no-nonsense engineering ethos.

&gt; However, with some of the shenanigans that the Linux distributions are pulling around age verification&#x2F;attestation...You&#x27;ve been misled.

My servers&#x2F;VMs typically run either FreeBSD or Alpine. A Debian here or there where needed (proxmox, VPS that doesn&#x27;t support Alpine, corp stuff, etc).I&#x27;ve also got a couple of test systems running Chimera - going to wait until it hits stable before relying on it too much though. Experimenting a bit with AerynOS too.

I&#x27;m in the same boat. I have 2 old servers that I let get &quot;too&quot; old, and now I&#x27;m afraid to touch them to update them. However, with some of the shenanigans that the Linux distributions are pulling around age verification&#x2F;attestation, I&#x27;m considering bailing on them entirely.Note, I did try Artix, but when it broke last week after a restart (in which evidently something had gone wrong with an earlier kernel update), and I had to pull out a rescue ISO, I decided I didn&#x27;t want to mess with that. I switched that machine to Devuan, but the jury is still out for me. I don&#x27;t have any major complaints, but I&#x27;m still in the burn-in phase. :) I&#x27;m running Arch on a laptop, but they have been a bit hostile in the community with censorship, so I&#x27;m just waiting for a free weekend to blast it and put something else on. I don&#x27;t want political drama in my software.This all comes at an interesting time, though. This is the first time that I purchased a new laptop and didn&#x27;t even let it boot into Windows, but instantly installed Linux. And everything &quot;just worked&quot;. And now that I&#x27;m excited to try Linux, so many of the big players are embracing the steps to erode privacy (AI everywhere... age attestation&#x2F;verification... telemetry on by default...). It&#x27;s sad, and I&#x27;m just going to &quot;nope&quot; out of any interactions with them.

I, too, have a server running 16.04 that I&#x27;m afraid to update. It currently has an uptime of 1281 days... at this point I&#x27;d feel bad rebooting it

My understanding is that the kernels are mostly equal. I’d be pretty surprised if one had a large impact one way or the other. Any differences I’d chalk up to the userspace program running it.

The benchmarks are completely off, and a recent version of Ubuntu with sane config would easily beat Freebsd.

I&#x27;ve switched to Debian (and since Ubuntu) for my server needs but I remember being obsessed in the mid 2000s with FreeBSD when I was younger. I would spend more time configuring and setting them up than doing anything actually useful on them.It used to be hard to find dedicated servers or VPSs with any of the BSDs, I think I settled on Panix.com or something?Before that I remember some company called 15MinuteServers (NAC?) out of NJ I think that offered them. Just kind of rambling down memory lane at this point though.

I love people that aren&#x27;t afraid to experiment and learn. As someone that hasn&#x27;t had a formal education in software engineering (just in other kind of engineering) I learned the most by doing and failing.

I pay $35&#x2F;month for a dedicated server for my nothing webpages. One the one hand, I could really host at home for $0&#x2F;month extra. Or on a VPS for $5&#x2F;month. I do need my own thing because I run a network testing tool that needs some amount of direct access.On the other hand, dedicated servers are more fun, even if the cpus I get for $35&#x2F;month are ancient. Is it $30&#x2F;month fun? Probably not, but it&#x27;s near zero given my situation.At least I&#x27;m sensible and don&#x27;t have an actual colo space to visit.In the unlikely event I go viral, I&#x27;m pretty sure my server can manage serving https at 1gbps, and that&#x27;s plenty. Maybe TLS is too much though, the cpus are too old for AESNI.

Personally I get my geek satisfaction from building systems that are rock-solid and require zero maintenance. Not choking on rare opportunities to go viral should they arise is a nice bonus too.

I don’t do it myself, but “objectively inferior in every meaningful way” is a bold claim. It might be harder, but we (geeks) love to do things ourselves.If someone is willing to use something like Hugo instead of garbage sites like Medium why not use a VPS? For many people working in tech $10&#x2F;month and free are the same thing.

some people (myself included) like hosting their own stack for fun or for learning.There&#x27;s additional concern with tying your work to something like github it makes it more of a pain to pull it off and put it somewhere else.I&#x27;m not really sure what you mean by objectively inferior. It&#x27;s trade offs like everything in this field.As far as harder, I don&#x27;t really think the lift for a personal VPS is that high. Again it&#x27;s a fun hobby project for most. It&#x27;s fun to run your own stack.If you want to opt into the github cloudflare goodness that&#x27;s fine they&#x27;re good services but I wouldn&#x27;t say it&#x27;s better or degnegrate others for not doing that.

You can make it zero deploy steps beyond git push with CodePipeline, and vibecoding makes the annoying config setup trivial if you know like 20% of what you&#x27;re doing. There is really zero reason to be using a VPS for this unless you hate money, want your site to choke during once-in-lifetime opportunities to go life-changingly viral, and like contributing to the global population malicious botnets.

s3 + cloudfront takes approximately 2 extra steps every deploy, and about 10 extra steps that are easy to screw up at setup time. It&#x27;s not a trivial drop-in, but yes, once it&#x27;s done it&#x27;s _really_ done.

Another option is cloudflare pages. Can be coupled with any hub or you can just push html artifacts.

Boggles my mind that people pay money to host hugo static sites on a VPS, which is objectively inferior and harder in every meaningful way compared to hosting for free on GitHub pages or S3+CloudFront.

I recently switched from Debian based servers to OpenBSD and I have never been happier. I wish I would have done it much, much earlier.

&gt; I don’t know why fastfetch always report more memory being used than the actual values. I’ve never seen more than 3GiB used in btop for this serverMy guess would be that fastfetch probably reports actual memory usage while btop probably reports the total usage of all processes. The former is probably higher because of things like filesystem caching

Blog ran on Ubuntu 16.04 for 10 years. I migrated it to FreeBSD

Project Hail Mary – Stellar Navigation Chart

Using Kagi Search with Low Vision

For the past 5 years or so I&#x27;ve been working on a ground-up redesign of Freenet, my peer-to-peer project from the early 2000s (now renamed Hyphanet).The new Freenet has been up and running since December along with some early applications like River[1], our decentralized group chat and Delta - a decentralized CMS. Users have already started to build their own apps on Freenet including games, and we have some interesting apps in development like Atlas, a search&#x2F;recommendation engine.Architecturally, this new Freenet is a global, decentralized key-value store where keys are webassembly contracts which define what values (aka &quot;state&quot;) are valid for that key, how or when the values can be mutated, and how the state can be efficiently synchronized between peers.We&#x27;ve developed a unique (AFAIK) solution to the consistency problem, every contract must define a &quot;merge&quot; operation for the contract&#x27;s associated state. This operation must be commutative, meaning that you can merge multiple states in any order and you&#x27;ll get the same end result.This approach allows state updates to spread through the network like a virus[2], which typically achieves consistent global state in a few seconds or less.Like the world wide web, Freenet applications can be downloaded from the network itself and run in a web browser - similar to single-page apps on the normal web. However, rather than connecting back to an API running in a datacenter, the webapp connects locally to the Freenet peer and interacts with Freenet contracts and delegates over a local websocket connection.If you&#x27;d like to try Freenet we have convenient installers for the major desktop OSs but not yet mobile, and you can be chatting with other users on River within seconds[3]. Happy to answer any questions, you&#x27;re also welcome to read our FAQ[4], or watch a talk I gave back in March[5].[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;freenet&#x2F;river" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;freenet&#x2F;river</a>[2] <a href="https:&#x2F;&#x2F;freenet.org&#x2F;about&#x2F;news&#x2F;summary-delta-sync&#x2F;" rel="nofollow">https:&#x2F;&#x2F;freenet.org&#x2F;about&#x2F;news&#x2F;summary-delta-sync&#x2F;</a>[3] <a href="https:&#x2F;&#x2F;freenet.org&#x2F;quickstart&#x2F;" rel="nofollow">https:&#x2F;&#x2F;freenet.org&#x2F;quickstart&#x2F;</a>[4] <a href="https:&#x2F;&#x2F;freenet.org&#x2F;faq&#x2F;" rel="nofollow">https:&#x2F;&#x2F;freenet.org&#x2F;faq&#x2F;</a>[5] <a href="https:&#x2F;&#x2F;youtu.be&#x2F;3SxNBz1VTE0" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;3SxNBz1VTE0</a>

Show HN: Freenet, a peer-to-peer platform for decentralized apps

We're testing new ad formats in Search and expanding our Direct Offers pilot

Was my $48K GPU server worth it?

Indexing a year of video locally on a 2021 MacBook with Gemma4-31B (50GB swap)

Spotify will start reserving concert tickets for fans

Seattle Shield, an intelligence-sharing network operated by the Seattle police

Hey HN, We&#x27;re Gus and Carlos from Runtime (<a href="https:&#x2F;&#x2F;runtm.com">https:&#x2F;&#x2F;runtm.com</a>). We&#x27;re building infra that lets your whole team (including non-engineers) ship with Claude Code, Codex, and other agents without engineering having to handhold every session.After Mentum (YC S21) was acquired, I personally shipped 4 full-stack products in 3 months using coding agents. When I tried to roll the same workflow out to the rest of the team, it fell apart: Most PRs were unmergeable slop - Every repo required an engineer doing one-off local setup. - Skills and context lived in one person&#x27;s head. - There was no safe way for a PM to touch a real codebase without risking a bad deploy or a secrets leak.Carlos comes from building agentic reconciliation systems at Modern Treasury and had a similar experience when letting his support team use devin.We ended up building internal background agent infra but it quickly became a nightmare to mantain and develop. We built Runtime so you don&#x27;t have to do this kind of thing.Runtime work like as follows. Engineering defines the context once: system instructions, skills, and scoped integrations installable via CLI, mise, npm, or any package manager. Then Runtime snapshots your full running environment including multi-service Docker Compose setups, Kafka, Redis, seeded DBs, so it comes up in milliseconds with every server already running.We orchestrate across sandbox providers like E2B, Daytona, EC2 or self-hosted K8s depending on your setup. Secrets are injected through our managed proxy so they never touch the agent directly, and guardrails run at the infrastructure level: command allow&#x2F;deny lists, network egress controls, and RBAC scoped per human and per agent. Every session also gets a shareable preview URL, so internal builds go from sandbox to the rest of the team without needing production access.Runtime works with whichever agent your team already uses: Claude Code, Codex, Cursor, Copilot, Gemini, Devin. You can trigger sandboxes from our web app, CLI, Slack, Linear, GitHub, or API.One of our customers built an on-call inspector that wires PagerDuty, Sentry, and their repo so when an alert fires, the agent finds the cause and opens a PR with a unit test before anyone gets paged. Another runs a finance agent in a private Slack channel pulling from Stripe, NetSuite, and Snowflake to run reconciliations in minutes with source rows attached.A fintech unicorn and several YC scaleups are live on Runtime, including a few teams who had built similar infrastructure internally and handed it to us to take over.The core is open source at <a href="https:&#x2F;&#x2F;github.com&#x2F;runtm-ai&#x2F;runtm" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;runtm-ai&#x2F;runtm</a>. Hosted version is live at <a href="https:&#x2F;&#x2F;app.runtm.com">https:&#x2F;&#x2F;app.runtm.com</a>, free tier included. We&#x27;re charging a flat platform fee plus compute, no token markup.Check our demo: <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=wLwj__aEEh4" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=wLwj__aEEh4</a>We&#x27;d love to hear how you&#x27;re thinking about the infra for letting more people across your org use coding agents without creating chaos!

Launch HN: Runtime (YC P26) – Sandboxed coding agents for everyone on a team

Waymo pauses Atlanta service as its robotaxis keep driving into floods

Python 3.15: features that didn't make the headlines

BBEdit 16

Flipper One – we need your help

Lost Images from the 1945 Trinity Nuclear Test Restored

Mycorrhizal Fungi, Nature's Key to Plant Survival and Success

Uv is fantastic, but its package management UX is a mess

Where are all the UK red telephone kiosks?

Hi HN! We&#x27;re Haakam, Michael, and Adi from AgentMail- a ycs25 company. We give AI agents their own email inboxes. Recently, we ran an experiment called Agent.Email. It&#x27;s a signup flow designed specifically for AI agents instead of humans.The inspiration came from a few comments we received when we did our seed launch a few months back. They all came from the very apt observation that agents not being able to sign up to a product made for agents without human credentials was ironic and unideal.This is basically the thesis we built AgentMail on: The internet was made for humans exclusively, designed to keep machines out by default.Every signup flow assumes a browser, a person reading a page, and clicking a confirmation link. Unless agents can&#x27;t do that, they can&#x27;t be first class users of the internet.Agents can now get an email inbox by themselves. (This also means a lot of email nobody wants to read gets processed by AI instead of your inbox being cluttered with spam and slop)Here&#x27;s how agent.email works.Agent needs an inbox and hits AgentMail via curl.
Agent receives instructions via MD unless the request comes from a browser, in which case we use HTML.Agent decides agent.email is useful and then hits the sign-up endpoint with its human email as a parameter.
Agent receives a restricted inbox with credentials. 
Agent emails the human asking for an OTP. Human replies with the code, and the agent is claimed and restrictions are lifted. 
Until claimed, the agent can only email its own human and nobody else. Ten emails a day, and the signup endpoint is rate-limited hard by IP.Right now it&#x27;s a 1:1 mapping between agent and human. The next step is many-to-one, because one person running several agents in parallel is already very common.Building agent.email also pushed us to revisit places in AgentMail where the default assumptions were built around the primary user being human. For example, the CLI outputs in a single column with consistent formatting because mixed delimiters are easy for a person to scan, but harder for an agent reasoning about structure. We also shortened messageIDs after agents started hallucinating completions on longer ones.A few things we&#x27;d like the community&#x27;s take on: is restricted-until-claimed the right trust model? 
Does agent self-signup feel useful in production, or is it mostly a novelty, and if it&#x27;s a novelty now, what would make it actually useful? 
Should agent onboarding require human approval by default, or should some agents be able to fully self-provision? What do you think are some additional measures we can take for secure sign-ups?